Oct 17, 2024
0
Level 4
Is remember me token cookie secure?
Logging in using the "remember me" flag on dev environment with SESSION_SECURE_COOKIE=false creates the "remember me" cookie correctly and I can delete session cookies and still be logged in.
However on the production environment using SESSION_SECURE_COOKIE=true the "remember me" cookie is not created. So deleting session cookies logs me out.
Is this the expected behavior? And should I create my own "remember me" cookie creator as explained in this 5 year old post? https://blog.martinfjordvald.com/setting-a-secure-remember-me-cookie-in-laravel/
Please or to participate in this conversation.